Dil Phagura
An executive I work with found out the hard way, when a courier left a signed delivery at a house she had not owned for six years. The package was legitimate. The address had come from a people search page sitting fourth in the results for her own name, one position above the firm bio her marketing team had spent a year building.
She had seen that page before and decided it was harmless, because every field on it was technically public. What changed her mind was the birth year printed beside her name and the two first names listed under relatives, which belonged to her children.
What a data broker page actually holds about you
When I open one of these records properly, the fields look dull one at a time. A name, a birth year, a current address and two or three former ones, a mobile number that still connects, an employer, and a list of relatives and people the site calls known associates.
Some of them add a property value, a vehicle, a neighbor, and a line that hints at a court record without ever saying what it was. No single field there is interesting on its own. The assembly is what does the damage, because a stranger reading from the top down ends up with a dossier that nobody authorized and nobody checked.
That is also why this category behaves differently from most of the work I do. A critical article has an author and an argument, and both of those can be answered. A broker page has neither, so there is nothing to respond to and the only move with any value in it is getting the record taken down.
Why opting out of one data broker does almost nothing
California keeps a public register of companies that have told a state regulator they trade in personal information, and the data broker registry runs to hundreds of entries. That register covers only the firms that filed. The ones that never registered are buying and selling all the same.
Underneath the retail sites the market is far smaller than it appears. A handful of large aggregators do the collecting, then license the same file out to dozens of consumer facing brands, several of which share a parent company and differ mainly in their logo. The Privacy Rights Clearinghouse has been documenting that structure for years, and reading it is the fastest cure for the idea that there are five of these sites.
So a successful opt out on one site removes a copy. The source that supplied the copy is untouched, and the next time it licenses the file your record turns up somewhere new, with your consent nowhere in the transaction.
I would rather a client work six brokers every quarter for two years than work sixty once and call the problem closed.
What order to work a data broker removal in
The first pass is an inventory, and it is slower than anyone expects. Most opt out forms want the exact address of the record rather than a general request, so somebody has to run the name queries, open every result and write each page address down. I have written before about how to check what is being said about you, and the same query discipline carries over here.
Second come the upstream aggregators, ahead of any retail site. Working the small sites first feels productive and then undoes itself, because the aggregator that fed them is still licensing and the pages come back within a cycle or two.
Third is the search side. Google will consider removing results that expose personally identifiable information, and its process for finding and removing personal info in Search is the only step in this sequence that changes what a reader sees inside a week. The page can go on existing while the result stops appearing, which buys time for the slower work underneath.
Fourth is the long tail, worked in batches over weeks instead of in one sitting. Fifth, and this is the step almost everybody drops, is a repeating calendar entry. Without it the first four steps are a single clean afternoon that quietly expires.
What the opt out forms ask you to hand over
There is an uncomfortable trade sitting in the middle of this. A fair number of these sites will not process a removal without an email address, a confirmation click, and in some cases a photograph of a government identity document.
Send only what the form requires, use an email address kept for this purpose and nothing else, and stop at any site asking for materially more than its neighbors do. Where the record underneath is a court filing or something drawn from a credit header, that is a different process under different rules, and the person to ask is a lawyer who has read the actual document.
How long data broker removal takes and how often it repeats
On the upstream sources, results usually start dropping out between two and six weeks after a request lands. The long tail runs three to four months, partly because a share of the smaller sites ignore a first request entirely and have to be asked a second time, in writing, with the page address attached again.
Then the cycle starts over. Public records refresh, lists change hands again, and records that were cleanly removed tend to reappear somewhere inside six to twelve months. This is a standing chore with no finish date, and anybody describing it as a one time cleanup is selling the version of the service that is easy to sell.
Two things did not move for that executive, and both were predictable before we started. Her property record stayed exactly where it was, because a county office holding a public document is not a broker and has no opt out form to send anything to. The same is true of a licence register, a corporate filing and a court docket.
Her firm bio also did not climb simply because the broker pages fell away. Removing a page frees a position. Filling that position is separate work on a separate schedule, and it runs longer than the removals do.
Her first screen was clear of broker pages about four months in, and it has taken a morning of attention every quarter since to stay that way. I cannot make a public document private, and I cannot stop a company from licensing the same file again next year. What this work buys is the gap between the two, and the gap is worth having.
The durable version of this is a recurring reminder that outlives the alarm that created it.
Dil Phagura is the Co-Founder and CEO of AI Reputation. Connect on LinkedIn at https://www.linkedin.com/in/dilphagura
